中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：20 小时前 重新扫描
15 /100
browser-agent
浏览器自动化 Agent 技能，基于 Chrome DevTools Protocol (CDP) 和 WebSocket 实现 AI 对浏览器的直接控制
A legitimate browser automation skill using Chrome DevTools Protocol with all functionality documented. No malicious behavior detected; only local connections to localhost CDP endpoints.
技能名称browser-agent
分析耗时32.8s
引擎pi
✓
可以安装
Approve for use. Consider pinning dependency versions more strictly for production deployments.

安全发现 2 项

严重性 安全发现 位置
低危
Dependency versions not strictly pinned 供应链
requirements.txt uses >= operators without upper bounds, allowing potentially breaking changes to be installed automatically.
websocket-client>=1.6.0
→ Consider pinning to specific versions: websocket-client==1.6.0
 scripts/requirements.txt:2
低危
package.json also uses flexible version ranges 供应链
package.json dependencies use >= operators without upper bounds.
"websocket-client": ">=1.6.0"
→ Pin to specific versions for reproducible builds
 package.json:33
资源类型声明权限推断权限状态证据
浏览器 READ READ ✓ 一致 CDP WebSocket connections for browser control
文件系统 WRITE WRITE ✓ 一致 browser_agent.py:121 - writes screenshots to disk
网络访问 READ READ ✓ 一致 browser_agent.py:64-70 - localhost HTTP/WebSocket only
命令执行 NONE NONE — No shell execution observed
环境变量 NONE NONE — No environment variable access detected
4 项发现
🔗
中危 外部 URL 外部 URL
https://chromedevtools.github.io/devtools-protocol/
README.md:190
🔗
中危 外部 URL 外部 URL
https://websocket-client.readthedocs.io/
README.md:191
🔗
中危 外部 URL 外部 URL
https://www.iana.org/help/example-domains
测试报告.md:138
🔗
中危 外部 URL 外部 URL
http://127.0.0.1:18800
测试报告.md:170

目录结构

9 文件 · 38.7 KB · 1425 行
Markdown 5f · 869L Python 2f · 491L JSON 1f · 55L Text 1f · 10L
├─ ▾ 📁 references
│ └─ 📝 api_reference.md Markdown 190L · 3.7 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 browser_agent.py Python 294L · 10.0 KB
│ ├─ 📄 requirements.txt Text 10L · 152 B
│ └─ 🐍 session_manager.py Python 197L · 6.1 KB
├─ 📋 package.json JSON 55L · 1.3 KB
├─ 📝 README.md Markdown 196L · 3.9 KB
├─ 📝 SKILL.md Markdown 131L · 4.7 KB
├─ 📝 封装总结.md Markdown 128L · 4.2 KB
└─ 📝 测试报告.md Markdown 224L · 4.7 KB

依赖分析 2 项

包名版本来源已知漏洞备注
websocket-client >=1.6.0 pip 否 Version not pinned
requests >=2.31.0 pip 否 Version not pinned

安全亮点

✓ All functionality explicitly declared in SKILL.md
✓ No credential harvesting or exfiltration detected
✓ Only local network connections (localhost:18800/9222) - no external IP communication
✓ No obfuscation, base64 execution, or suspicious encoding patterns
✓ No hidden functionality beyond documented features
✓ JavaScript evaluation (Runtime.evaluate) is standard browser automation, properly documented
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No reverse shell, C2, or data theft patterns observed
✓ Clean code with no anti-analysis techniques